From: Hank Grabowski Date: Mon, 6 Nov 2023 16:25:13 +0000 (-0500) Subject: Use strtok to find QP's in Uri for OAuth redirect processing X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=35a726a961a8298889738d7b5b063a559d689129;p=friendica.git Use strtok to find QP's in Uri for OAuth redirect processing --- diff --git a/src/Module/OAuth/Token.php b/src/Module/OAuth/Token.php index 7e22a88dab..25c0c69137 100644 --- a/src/Module/OAuth/Token.php +++ b/src/Module/OAuth/Token.php @@ -90,10 +90,10 @@ class Token extends BaseApi $me = null; } elseif ($request['grant_type'] == 'authorization_code') { // For security reasons only allow freshly created tokens - $uri = new Uri($request['redirect_uri']); + $redirect_uri = strtok($request['redirect_uri'],'?'); $condition = [ "`redirect_uri` LIKE ? AND `id` = ? AND `code` = ? AND `created_at` > ?", - '%' . $uri->getScheme() . '://' . $uri->getHost() . $uri->getPath() . '%', $application['id'], $request['code'], DateTimeFormat::utc('now - 5 minutes') + $redirect_uri, $application['id'], $request['code'], DateTimeFormat::utc('now - 5 minutes') ]; $token = DBA::selectFirst('application-view', ['access_token', 'created_at', 'uid'], $condition); diff --git a/src/Security/OAuth.php b/src/Security/OAuth.php index 7655398b35..f6a01a2a87 100644 --- a/src/Security/OAuth.php +++ b/src/Security/OAuth.php @@ -131,8 +131,7 @@ class OAuth } if (!empty($redirect_uri)) { - $uri = new Uri($redirect_uri); - $redirect_uri = $uri->getScheme() . '://' . $uri->getHost() . $uri->getPath(); + $redirect_uri = strtok($redirect_uri, '?'); $condition = DBA::mergeConditions($condition, ["`redirect_uri` LIKE ?", '%' . $redirect_uri . '%']); } @@ -143,6 +142,7 @@ class OAuth } // The redirect_uri could contain several URI that are separated by spaces. + $exploded = explode(' ', $application['redirect_uri']); if (($application['redirect_uri'] != $redirect_uri) && !in_array($redirect_uri, explode(' ', $application['redirect_uri']))) { return []; }